Bill C-29

SUMMARY

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,

(a) exclude, in certain circumstances, business contact information from the application of Part 1 of that Act;

(b) specify the elements of valid consent for the collection, use or disclosure of personal information;

(c) permit the disclosure of personal information without the knowledge or consent of the individual for the purposes of

(i) identifying an injured, ill or deceased individual and communicating with their next of kin,

(ii) performing police services,

(iii) preventing, detecting or suppressing fraud, or

(iv) protecting victims of financial abuse;

(d) clarify the meaning of lawful authority for the purpose of disclosures to government institutions of personal information without the knowledge or consent of the individual;

(e) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of the individual, personal information

(i) contained in witness statements related to insurance claims, or

(ii) produced by the individual in the course of their employment, business or profession;

(f) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of the individual, personal information related to prospective or completed business transactions;

(g) permit federal works, undertakings and businesses to collect, use and disclose personal information without the knowledge or consent of the individual to establish, manage or terminate employment relationships;

(h) provide a framework for organizations to notify individuals proactively about disclosures of their personal information made in certain circumstances to government institutions; and

(i) require organizations to report material breaches of security safeguards to the Privacy Commissioner and to notify certain individuals and organizations of breaches that create a real risk of significant harm.